[SECURITY] [DSA 6414-1] udisks2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6414-1 [email protected] https://www.debian.org/security/ Alberto Garcia August 06, 2026 https://www.debian.org/security/faq -...

EUVD-2026-41938

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port...

CVE-2026-71327 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and...

CVE-2026-71327 Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Traefik is an open source HTTP reverse proxy and load balancer. From 3.0.0 until 3.6.25 and 3.7.10, Traefik's Kubernetes Gateway API provider in pkg/provider/kubernetes/gateway/httproute.go, grpcroute.go, tcproute.go, and tlsroute.go builds HTTPRoute, GRPCRoute, TCPRoute, and TLSRoute router and...

CVE-2026-56846

A flaw was found in Node.js's handling of HTTP/2. This vulnerability allows a remote attacker to bypass maxSessionMemory limits by sending specially crafted HTTP/2 retained header blocks. This can lead to memory exhaustion, resulting in a denial of service DoS for the affected system. Mitigation ...

Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Summary There is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured...

CVE-2026-71326 Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basicauth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and...

CVE-2026-71326

CVE-2026-71326 affects Traefik’s BasicAuth middleware (pkg/middlewares/auth/basic_auth.go) in 3.6.11–3.6.25 and 3.7.10. The vulnerability arises from deduplicating concurrent password checks using a singleflight key built from the delimiter-free concatenation of password and secret, enabling an a...

CVE-2026-19059

FoundationAgents MetaGPT (up to version 0.8.2) contains a path traversal flaw in metagpt/tools/libs/editor.py: the read function is vulnerable, enabling local attackers to traverse the filesystem. The issue is local-access, with a publicly disclosed exploit. Vendor contact about the disclosure oc...

CVE-2026-71325

Traefik is an open-source edge router that makes publishing services a fun and easy experience. Prior to 2.11.54, 3.6.25, and 3.7.10, cross-namespace @kubernetescrd references are not rejected for TraefikService backend references resolved by the service resolver. A tenant confined by RBAC to a...

MAL-2026-13437 Malicious code in aitable-workflow-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9fd48b8764ece5b776ed22530ce8c86ffef1093f52fc74ab00fbb740817af82 The package's dist/index.js contains code combining OS command execution ping with outbound HTTP POST requests, a pattern consistent with host...

New Interrupt Injection Attack Can Bypass Spectre v2 Defenses on Intel and AMD CPUs

An unprivileged Linux program can time a hardware interrupt to land in the gap between a processor sanitizing its branch predictor and the kernel using it, re-poisoning the predictor after the defense has run. MIT CSAIL researchers Daniël Trujillo and Mengjia Yan named the technique INTERRUPT...

Malicious code in content-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5656ce6bbda8526587e40810d90b3188e11d507ebb13168203384bfac6b5ec1b [email protected] declares a preinstall lifecycle script in package.json that executes node -e to perform an HTTP GET to a unique subdomain of...

CVE-2026-68747

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-66843

Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene htmlsanitizeex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an element in sanitized HTML. object is the one URI-bearing element in...

CVE-2026-19047

A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component luduscliexecute. Performing a manipulation of the argument command/args results in command injection. The...

MAL-2026-13449 Malicious code in merchantweb-lang-cookie-reset (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fff16333aa7ffc7fc2c7decc1458c23b7d89f8caacb5c6129ba76168d08ec4be package.json declares the sole dependency packet-table-thread-stream as a direct tarball URL to a non-npm host...

Security Bulletin: Platform Navigator in IBM Cloud Pak for Integration is vulnerable to Denial Of Service due to vulnerabilities in Immutable.js

Summary Platform Navigator in IBM Cloud Pak for Integration is vulnerable to Denial Of Service due to vulnerabilities in Immutable.js CVE-2026-59879, CVE-2026-59880. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js provides many...

CVE-2026-71324 Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik is an open source HTTP reverse proxy and load balancer. Prior to 2.11.53, 3.6.24, and 3.7.9, Traefik's default HTTP reverse proxy forwards a plain HTTP/2 or HTTP/3 CONNECT request and its body to an HTTP/1.1 upstream through a shared net/http.Transport. When the upstream answers the CONNE...

CVE-2026-43631

The CVE affects llama.cpp builds from b7492 to b9060, where a use-after-free in the vocab pointer of llama-server occurs when --sleep-idle-seconds is enabled. Unauthenticated remote attackers can trigger this by sending requests to affected endpoints as the server transitions to sleep mode, causi...